Reverse Proxy Misconfigurations · passage 4 of 9

X-Forwarded-For

2 code blocks · Reverse Proxy Misconfigurations/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

`X-Forwarded-For` is an HTTP header used to identify the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. When a client makes a request through a proxy or load balancer, that proxy adds an X-Forwarded-For header containing the client’s real IP address. If there are multiple proxies (a request passes through several), each proxy adds the address from which it received the request to the header, comma-separated.

X-Forwarded-For: 2.21.213.225, 104.16.148.244, 184.25.37.3

Nginx can override the header with the client's real IP address.

proxy_set_header X-Forwarded-For $remote_addr;

Every one of the 9 is a mark on the map. Named now: 1 to 9, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.